US6356941B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Network vaults
Assignee: Cyberark Software Ltd
•
Filing: 1999-02-22
•
Granted: 2002-03-12
•
Expires: 2019-02-22
Abstract
Abstract A system for secure data storage, exchange and/or sharing through a protected central storage facility, containing at least one “network vault” to which access is controlled through a single data access channel. The network vault is similar to a physical safe, in that substantially any type of information can be stored in the network vault, and in that the user need only place the information inside the network vault for the information to be secured. Thus, the system of the present invention combines the flexibility of data storage and retrieval through a network, with the security of controlled access for data storage and retrieval at a fixed physical location. The restriction of data access through a single data access channel greatly simplifies the task of protecting access to the data, since only this single channel must be monitored for unauthorized access, rather than monitoring many such channels (or interfaces). Also, the present invention enables data to be exchanged between two users and/or networks which do not trust each other, again by only permitting access to the stored data through the single data access channel, rather than by attempting to filter communication between the two parties. Thus, the present invention is able to provide security without declarations, since the data is moved into the security system, rather than attempting to impose the security system over an existing data access system.
Inventors
- 👤 Alon Cohen
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-10 02:30
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/04; H04L63/0428; G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; G06F21/6272; H04L63/10; H04L63/08; H04L63/083
Claims Analysis
Total Claims: 33
Claim 1
Independent Claim
232 words
A system for enabling secured data storage and data utilization, said system comprising: a. a dedicated server computer with a sterile environment such that the only software code that is executable on said dedicated server computer is a network vault security software system; b. a hardware storage device for storing data, said hardware storage device is accessible only by said dedicated server computer; c. said network vault security software system, such that said security software system is installed on said dedicated server computer, for providing secure access to said data, said security software system includes an integrated multi-layers security mechanism for securing said data, and a server software mechanism for providing a set of services for managing and utilizing said data; d. a single data access channel within said sterile environment, such that said single data access channel ensures that only said network vault security software system is permitted to be operated by said dedicated server computer, and such that communication with said dedicated server computer is achievable only through said network vault security software system; e. a network for connecting at least one user to said secured data storage and data utilization system; and f. client software for communicating with said network vault security software system through said single data access channel, said client software operating on at least one user computer, said user computer operable to connect to said network.
Claim 2
Independent Claim
232 words
A system for enabling secured data storage and data utilization, said system comprising: a. a dedicated server computer with a sterile environment such that the only software code that is executable on said dedicated server computer is a network vault security software system; b. a hardware storage device for storing data, said hardware storage device is accessible only by said dedicated server computer; c. said network vault security software system, such that said security software system is installed on said dedicated server computer, for providing secure access to said data, said security software system includes an integrated multi-layers security mechanism for securing said data, and a server software mechanism for providing a set of services for managing and utilizing said data; d. a single data access channel within said sterile environment, such that said single data access channel ensures that only said network vault security software system is permitted to be operated by said dedicated server computer, and such that communication with said dedicated server computer is achievable only through said network vault security software system; e. a network for connecting at least one user to said secured data storage and data utilization system; and f. client software for communicating with said network vault security software system through said single data access channel, said client software operating on at least one user computer, said user computer operable to connect to said network.
Claim 3
Dependent Claim
36 words
The system of claim 1 , wherein said data is isolated within said hardware storage device, such that said data is accessible only by said network vault security software system through said single data access channel.
Claim 4
Dependent Claim
37 words
The system of claim 1 , wherein only said network vault security software system is permitted to be operated by said dedicated server computer, such that any other software program is inoperable by said dedicated server computer.
Claim 5
Dependent Claim
209 words
The system of claim 1 , wherein said multi-layers security mechanism further comprises: a. a virtual private network mechanism (VPN) for providing a secured communication channel between said security software system on said dedicated server computer and said client software on said user computer; b. a packet filter dedicated firewall for preventing any type of packet exchange with said dedicated server computer, other then communication with said security software system in said dedicated server computer; c. an authentication security layer for providing a two-way authentication hand-shake process between said security software system on said dedicated server computer and said user using said client software on said user computer; d. an access control security layer for providing controlled access to said data stored on said hardware storage device, such that said access is provided to said user only if said user is authenticated by said authentication security layer, and only if said user is permitted said access according to an access authorization list, such that said access to said data is permitted only through said single data access channel; and e. an encryption layer for encrypting and decrypting said data in said storage device, and for encrypting and decrypting data communicated between said dedicated server computer and said user computer.
Claim 6
Dependent Claim
41 words
The system of claim 4 , wherein said authentication layer authenticates said user according to a user identifier, said user identifier is selected from a group of identifiers consisting of a password, a key diskette, biometric information and a smart card.
Claim 7
Dependent Claim
63 words
The system of claim 4 , wherein said access control security layer further provides controlled access to said data, such that said access to said data is provided to said user only after a predefined period of delay, such that a user request to access said data is notified to a predefined plurality of users before said access to said data is permitted.
Claim 8
Dependent Claim
56 words
The system of claim 4 , wherein said access control security layer further provides controlled access to said data, such that said access to said data is provided to said user only after an approval of said access by at least one user of predefined plurality of users that must approve said access to said data.
Claim 9
Dependent Claim
58 words
The system of claim 4 , wherein said access control security layer further provides controlled access to said data, such that said access to said data is provided to said user only if predefined plurality of users are collectively connected to said network vault security system, such that said access is notified to all said plurality of users.
Claim 10
Dependent Claim
37 words
The system of claim 1 , wherein said network vault security software system further provides a history repository, such that said history repository is stored by said network vault security software system on said hardware storage device.
Claim 11
Dependent Claim
37 words
The system of claim 9 , wherein said history repository includes records of all access attempts to said data, such that each said record cannot be deleted from said history repository for a predetermined period of time.
Claim 12
Dependent Claim
35 words
The system of claim 9 , wherein said history repository includes all versions of said data, such that each said data version cannot be deleted from said history repository for a predetermined period of time.
Claim 13
Dependent Claim
38 words
The system of claim 9 , wherein said history repository is continuously updated and changes in said history depository are automatically sent as alerts to all relevant users, such that no periodic polling of the system is required.
Claim 14
Dependent Claim
85 words
The system of claim 1 , wherein said server software mechanism further comprises: (1) a network interface for communicating with said client software, said network interface receives packets from said network and sends packets to said network; and (2) a packet filter for forming said single data access channel in combination with said network interface, said packet filter filtering said packets received from said network according to a destination address, such that if said packets do not feature said destination address, said packets are dropped.
Claim 15
Dependent Claim
19 words
The system of claim 13 , wherein said destination address includes a network address of said dedicated server computer.
Claim 16
Dependent Claim
21 words
The system of claim 13 , wherein said destination address includes a transport address of said network vault security software system.
Claim 17
Dependent Claim
64 words
The system of claim 13 , wherein said server software further comprises: (3) a transaction gateway software module for receiving said packets from said packet filter and for receiving said data from said network vault; and; (4) an encryption software module for decrypting said packets received by said transaction gateway software module and for encrypting said data received by said transaction gateway software module.
Claim 18
Dependent Claim
49 words
The system of claim 13 , wherein said server software further comprises: (5) a transaction manager software module for receiving said decrypted packets from said transaction gateway software module and for determining at least one access request to access said data in said network vault from said decrypted packets.
Claim 19
Dependent Claim
38 words
The system of claim 13 , wherein said server software further comprises: (6) a security module for determining if said at least one access request to access said data in said network vault by said user is permitted.
Claim 20
Dependent Claim
34 words
The system of claim 18 , wherein said security module determines if said at least one access request is permitted, according to said access control security layer of said network vault security software system.
Claim 21
Dependent Claim
43 words
The system of claim 13 , wherein said server software further comprises: (7) a unique file system for organizing said data on said hardware storage device according to a unique organization, such that said data is accessible only according to said unique organization.
Claim 22
Dependent Claim
160 words
The system of claim 20 wherein said data is organized as a plurality of clusters such that a logical order of said plurality of clusters on said network vault differs from a physical order of said plurality of clusters on said hardware storage device, and wherein said server software further comprises: (8) a unique file system mapping table to map said logical order of said plurality of clusters on said network vault to said physical order of said plurality of clusters on said hardware storage device; and (9) a virtual disk driver for accessing said data through said unique file system according to at least one data access request, said virtual disk driver accessing said data only if said at least one data access request contains a logical address for at least one of said plurality of clusters matching a physical address for said at least one of said plurality of clusters, according to said unique file system mapping table.
Claim 23
Dependent Claim
45 words
The system of claim 21 , wherein said unique file system mapping table is stored on a removable storage medium external to said hardware storage device, such that when said removable storage medium is removed, said logical order of said plurality of clusters remains unknown.
Claim 24
Dependent Claim
127 words
The system of claim 1 , wherein said single data access channel further comprises: a. a system hook for preventing any additional software code from being operated by said dedicated server computer, to prevent installation and execution of a rogue software program for accessing said data; and b. a packet filter which acts as a gatekeeper for said single data access channel, said packet filter blocks any communication with said dedicated server computer other then communication with said security software system, such that incoming packets are permitted only if said packets are targeted to said security software system on said dedicated server computer, and such that outgoing packets are permitted only if said packets are being sent from said security software system on said dedicated server computer.
Claim 25
Dependent Claim
99 words
The system of claim 1 , wherein said network connects at least one additional user computer to the secured data storage and data utilization system, said additional user computer being operated by at least one additional user, such that said additional user is authenticated by said authentication security layer, said user and said additional user are permitted access to said data in said network vault according to said access control security layer, such that said user and said additional user securely exchange data through said network vault, without requiring communication between said user computer and said additional user computer.
Claim 26
Dependent Claim
34 words
The system of claim 24 , wherein at least one user is notified by said network vault security software system when said at least one additional user accesses said data on said network vault.
Claim 27
Dependent Claim
39 words
The system of claim 24 , wherein at least one user is immediately notified by said network vault when said additional user accesses said data of said network vault, such that no periodic polling of the system is required.
Claim 28
Dependent Claim
129 words
The system of claim 1 , wherein the system further comprises: a. an additional network for connecting at least one additional user to the secured data storage and data utilization system, such that at least one additional user computer is connected to said additional network, said additional user computer being operated by an additional user, said additional user is authenticated by said authentication security layer, said user and said additional user are permitted access to said data in said network vault according to said access control security layer, wherein said packet filter firewall prevents any packet exchange between said network and said additional network, such that said user and said additional user securely exchange data through said network vault, without requiring communication between said network and said additional network.
Claim 29
Dependent Claim
81 words
The system of claim 1 , wherein said client software further comprises: (A) a limited API (application programming interface) for interacting with said server software, such that only said API interacts with said server software, said API providing at least one service for accessing said data, such that said access to said data is provided through said single data access channel; and (B) at least one user software program for interacting with said user and said API to access said data.
Claim 30
Dependent Claim
33 words
The system of claim 1 , wherein said client software further comprises: (C) a RAM (random access memory) disk for receiving said data from said server software and for temporarily storing said data.
Claim 31
Dependent Claim
45 words
The system of claim 1 , wherein said client software further comprises: (D) a data replicator software module for providing data replication between at least two network vault systems, for providing higher availability of said data stored on said at least two network vault systems.
Claim 32
Dependent Claim
93 words
The system of claim 1 , wherein said client software further comprises: (E) a data splitter software module for splitting at least one file between at least two network vault systems, such that said file is mathematically split into a plurality of parts, such that each said part is meaningless without all other said parts of said file, such that each said part is stored on a different said network vault system, such that access to said file requires all said parts of said file from said at least two network vault systems.
Claim 33
Dependent Claim
112 words
The system of claim 31 , wherein said data splitter software module further comprises the steps of: (a) producing a plurality of pseudorandom bytes corresponding to a length of said at least one file; (b) performing a reversible mathematical operation on said plurality of pseudorandom bytes and said at least one file to obtain a resultant file combination; and (c) storing said resultant file combination and said plurality of pseudorandom bytes on different said network vault systems, such that said at least one file is accessible only if said at least one file is obtained from said resultant file combination and said plurality of pseudorandom bytes, according to said reversible mathematical operation.
References Cited (Backward Citations)
EP0043027A1
Cited
US5007083A
Cited
US5191611A
Cited
US5550976A
Cited
US5719938A
Cited
US5864683A
Cited
US5752031A
Cited
US5892917A
Cited
US6061798A
Cited
US5862346A
Cited
US5969632A
Cited
US5913041A
Cited
US5889958A
Cited
US6009475A
Cited
US5875296A
Cited
US6182222B1
Cited
US5911045A
Cited
US6105131A
Cited
US6021497A
Cited
US6026463A
Cited
US6052785A
Cited
US6098056A
Cited
US6018745A
Cited
US6105042A
Cited
US6163859A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2005-03-11 | 2005-09-10 | 2006-03-12 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2009-03-11 | 2009-09-10 | 2010-03-12 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2013-03-11 | 2013-09-10 | 2014-03-12 | $7700.00 | Window Closed / Lapsed |